{"id":"CVE-2020-1899","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-1899","generatedAt":"2026-10-27T21:18:59.703Z","title":"This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects.","description":"The unserialize() function supported a type code, \"S\", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.","published":"2021-03-11T01:15:14.000Z","lastModified":"2026-06-17T03:02:35.000Z","status":"Modified","sourceIdentifier":"cve-assign@fb.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-822","CWE-119"],"affected":["facebook/hhvm"],"epss":{"score":0.01218,"percentile":0.68427,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9","tags":["Patch","Third Party Advisory"],"source":"cve-assign@fb.com"},{"url":"https://hhvm.com/blog/2020/06/30/security-update.html","tags":["Vendor Advisory"],"source":"cve-assign@fb.com"},{"url":"https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://hhvm.com/blog/2020/06/30/security-update.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-1899","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}